@cosmicdrift/kumiko-types 0.274.0 → 0.275.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.274.0",
+  "version": "0.275.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/config.ts

@@ -3,7 +3,7 @@ import type { ConcurrencyMode } from "./concurrency-mode";
 import type { ConfigScope } from "./config-scope";
 import type { DbConnection } from "./db-connection";
 import type { FieldDefinition } from "./fields";
-import type { JobContext } from "./handlers";
+import type { EscapeHatchDeclaration, JobContext } from "./handlers";
 import type {
   PostDeleteHookFn,
   PostSaveHookFn,
@@ -392,6 +392,8 @@ export type JobDefinition = {
   // don't justify a separate worker container — long/CPU-heavy jobs on the
   // API lane will starve request handlers.
   readonly runIn?: JobRunIn | undefined;
+  // Grants `ctx.db.unsafeRaw(reason)` for this job, audited as `unsafe-raw`.
+  readonly escapeHatch?: EscapeHatchDeclaration | undefined;
 };
 
 // --- Notifications ---

package/src/feature.ts

@@ -382,6 +382,8 @@ export type FeatureDefinition = {
   // rendering. Absence means the feature reads no env-vars (or hasn't
   // been migrated yet — Sprint-9 migration is add-only per phase).
   readonly envSchema?: z.ZodObject<z.ZodRawShape>;
+  // Factory guarantee: two instances with shallow-equal dedupeOptions are interchangeable.
+  readonly dedupeOptions?: Readonly<Record<string, unknown>>;
 };
 
 // --- Feature Registrar (the "r" object in defineFeature) ---

package/src/handlers.ts

@@ -707,11 +707,14 @@ export type HandlerContext<TMap extends object = KumikoEventTypeMap> = SharedCon
 //
 // The passed identity also decides the target tenant — `writeAs` hands
 // `user.tenantId` straight to the dispatcher with nothing cross-checking it
-// against the job's own tenant, exactly as `queryAs` and the raw `db` above
-// already do. Building an identity from job payload data is therefore a
-// cross-tenant write path; derive it from a trusted lookup instead.
+// against the job's own tenant, exactly as `queryAs` does. Building an
+// identity from job payload data is therefore a cross-tenant write path;
+// derive it from a trusted lookup instead.
 export type JobContext = SharedContextFields & {
-  readonly db: DbConnection;
+  // Tenant-filtered to the job's own tenant. Cross-tenant raw access needs
+  // `escapeHatch` on the job (`ctx.db.unsafeRaw(reason)`) or `r.systemScope()`
+  // (`ctx.systemDb`).
+  readonly db: TenantDb;
   readonly registry: Registry;
   readonly systemUser: SessionUser;
   readonly log: Logger;